Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
120
votes
5answers
27k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
116
votes
4answers
21k views

How would a resourceful government block Tor?

I came across this article saying that after the November 2015 Paris attacks, some French police officers proposed to ban Tor. Tor is used to circumvent censorship! What security techniques would ...
83
votes
2answers
37k views

Best practices for Tor use, in light of released NSA slides

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
73
votes
4answers
57k views

How can you be tracked using screen resolution/monitor size in Tor?

Whenever I maximize the Tor browser, it shows a warning: Maximizing Tor Browser can allow websites to determine you monitor size, which can be used to track you... How can screen resolution or ...
70
votes
1answer
6k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
70
votes
6answers
59k views

Differences between using Tor browser and VPN

I can't quite figure out the differences between using the Tor browser and using a VPN (like concretely proXPN). From what I understand the idea is the same, that they both hide the IP address. The ...
57
votes
5answers
86k views

How do you get a specific .onion address for your hidden service?

.onion addresses normally should be made of a base32 string of the first 80 bits of the SHA1 hash of the private key of the server (see .onion address specification). Today I ran into a service which ...
47
votes
7answers
6k views

How does Tor protect against an attacker just running thousands of nodes?

Does Tor have any protection against an adversary simply running a very large number of nodes? Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
42
votes
3answers
24k views

How does check.torproject.org know if you're using Tor?

I'm looking at the results from the following URL and would like to know how does the Tor Project website "know" that Tor is being used or not. https://check.torproject.org/?lang=en-US&small=1&...
41
votes
3answers
8k views

Can anti-virus/virus protection be used to spy on you? [closed]

I'm a complete noob when it comes to these subjects. But here goes... Let's say someone is using a VPN, TOR, or some other tool to enhance their privacy. As I understand it, you are discouraged from ...
41
votes
2answers
9k views

Why hasn't anyone taken over Tor yet?

Tor is known to encrypt the transferred content and the meta information by layering the encryption. I know there have been correlation attacks that deanonymized some users by federal agencies. Why ...
37
votes
8answers
22k views

If I visit a HTTPS website when using Tor, is my IP exposed?

HTTPS is an end-to-end encrypted connection. Given this, does the website I am visiting know my original IP? The website is only available over HTTPS (not unencrypted HTTP).
35
votes
6answers
22k views

How to detect if employees are using Tor?

We work in an organisation which is supposed to be HIPAA compliant. Security is a big concern for us. We've been tasked to find out if any user is using anonymous proxy in the network. Is there a way ...
34
votes
3answers
11k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
33
votes
1answer
19k views

Why is Home --> VPN --> Tor worse than Home --> Tor?

I've read lot of questions asked on various websites about the pros & cons of using a VPN with Tor. As said on Tails website VPN make the situation worse by introducing a permanent entry guard or ...
28
votes
4answers
2k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
25
votes
6answers
19k views

Why is Tor safer than a proxy?

If I use a Tor router to browse the regular internet, my traffic must leave the Tor network through an exit node. Apparently the exit node can see the data originally sent. Is this true? If an ...
24
votes
3answers
58k views

Can my workplace view my Tor traffic?

I connect to the internet using my company's Wi-Fi and Tor. Can they still see the websites I visit?
24
votes
2answers
7k views

In the SilkRoad takedown, what does it mean "An IP address was leaking" in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the ...
19
votes
3answers
24k views

How did the FBI compromise Tor users? [closed]

I read in this article that the FBI was able to crack the anonymity of Tor. From what I heard and read, onion routing makes it almost impossible to de-anonymize a user. The last time I heard anyone ...
19
votes
5answers
38k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
19
votes
1answer
3k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
18
votes
5answers
3k views

Stop large requests to my server (TOR)

I am being attacked right now from Tor nodes which are doing 404 requests to my HTTP server. It is from one IP but when i use the DROP iptables rule, it starts again from another IP in a matter of ...
18
votes
4answers
5k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
16
votes
2answers
15k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
16
votes
1answer
5k views

How are tor hidden nodes/services found?

Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion. Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server? I don't think there's a central ...
15
votes
3answers
4k views

Is the fact that Tor's development is largely government funded cause for concern?

In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one. Wikipedia's article states; As of 2012, 80% of the Tor Project's $2M annual budget comes ...
14
votes
3answers
9k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
14
votes
3answers
65k views

Downloading files using Tor

I have the Tor Browser Bundle installed and have been using the Firefox Tor browser. If I attempt to download a file or email attachment I get the following warning I understand that if I download an ...
14
votes
3answers
5k views

Why is Tor over HTTPS insecure?

I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
14
votes
4answers
17k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
14
votes
2answers
5k views

Does Tor help us to prevent ISP tracking?

If Tor is able to hide the IP address of the machine and make us anonymous, then does it prevent the ISP from tracking us?
14
votes
2answers
5k views

How does Tor protect against fake entry nodes / total redirection?

There is much material on how to protect yourself from malicious exit nodes, especially by using SSL and minimizing the leakage of identifying information (user-agent, screen size, etc.). However, I ...
13
votes
3answers
2k views

Is there any difference between visiting Facebook via their Tor address, and visiting them via their normal address over Tor?

From a security perspective, is visiting via the .onion address more/less secure? I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor ...
13
votes
2answers
9k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
13
votes
2answers
21k views

Is using VPN, Tor and ProxyChains together more secure?

Similar question (Tor and VPN only). All these three technologies seem to share the same goal, i.e. making internet traffic anonymous. Does it make any sense to try to use them together to increase ...
13
votes
1answer
3k views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
12
votes
8answers
13k views

How anonymous is my setup?

my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came. Our setup is as follows: A windows ...
12
votes
3answers
37k views

Is it safe to access HTTP sites from Tor?

Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit. I searched on the subject and somewhere else I read that the ...
12
votes
4answers
4k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
12
votes
2answers
1k views

How does Tor maintain anonymity when a source and destination are required at the end? [duplicate]

I had a question about Tor and the anonymity status of a fully decrypted packet that leaves a Tor exit node. My high-level understanding is that prior to a packet traversing the Tor network, a Tor ...
11
votes
4answers
13k views

What are the disadvantages of Tor?

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits. What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
11
votes
1answer
9k views

What are the implications of running a Tor non-exit relay node?

Intuitively, running a non-exit Tor node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
11
votes
4answers
39k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
11
votes
1answer
4k views

wget: what security issues am I not considering?

Questions: based on the details provided below, (a) what potential security vulnerabilities and threats might I face in my use of wget and (b) what recommendations would you give for mitigating those ...
10
votes
3answers
54k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
10
votes
1answer
2k views

Different types of Tor bridges - implications for detection of Tor use

I am trying to figure out the implications of using the different types of Tor bridges - such as meek, obfs4, etc. My threat model: I am engaged in entirely legal, non-violent communications, but I ...
10
votes
1answer
1k views

Firefox 52 Privacy and Fonts

My understanding is that Firefox 52 was to include features which increased privacy while browsing the web. Specifically, it was going to include a feature which limited the number of system fonts ...
9
votes
4answers
12k views

How is Tor secure despite being open source?

If Tor is open source (and thus its process of concealing your IP is known), then how does it keep anything secure? Couldn't someone look at the source code and figure out how to reverse the routing ...
9
votes
1answer
20k views

How can I get the IP address for a Tor Hidden Service (HS) with a .onion address?

I'd like to find out the IP address of a given .onion address. Is it possible for me to simply assign an exit node (that I control) to my client and just monitor it to determine what IP address ...

1
2 3 4 5
10